The maximum event log size is set too high
[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]
Topic Last Modified: 2009-02-05
The Microsoft Exchange Server Best Practices Analyzer examines the size settings for the following event logs:
Application log
Security log
The tool performs this examination to verify that the log file sizes are set to an appropriate value for the amount of memory that is in use on the Exchange server. During this examination, the Best Practices Analyzer determines whether the following conditions are true:
Insufficient free system Page Table entries (PTEs) are available on the computer.
The maximum event log file size is set to a value that is greater than 64 megabytes (MB).
If the Best Practices Analyzer determines that insufficient system PTEs are available and that the log file is set to a size that is greater than 64 MB, the tool generates the following warning message:
The size of the '<logFileName>' log on server <ServerName> is larger than 64MB. This may cause high usage of Page Table Entries(PTE). Maximum application log size can be modified using the Event Viewer. Current size: <Size>MB. |
If the maximum event log sizes are set to a high value, such as 100 MB or more, you may experience a shortage of system PTEs. If system PTEs are unavailable, Exchange may be unable to run, or the operating system may become unstable.
System PTEs hold stack allocations for each thread in a program. When a thread makes a kernel mode call, the stack allocations are used. More system PTEs are used as more processes are run on the server.
32-bit versions of Windows Server 2003 allocate 660 MB for system PTEs. In contrast, 64-bit versions of Windows Server 2003 allocate 128 gigabytes (GB) for system PTEs. Therefore, you are much less likely to experience this issue on a computer that is running a 64-bit version of Windows Server 2003. Additionally, if you use the /3GB Boot.ini parameter to allocate more address space to user mode processes, you decrease the number of available system PTEs.
To address this issue, set the appropriate event log file size in Windows Server 2003.
To configure an event log size in Windows Server 2003
Click Start, click Run, type eventvwr, and then click OK.
In the Event Viewer snap-in, right-click Application or Security, depending on the log file that you want to configure, and then click Properties.
On the General tab, type 65536 in the Maximum log size box, and then click OK.
On the message that states that the new log file size does not take effect until you clear the log, click OK.
Right-click the same log file, and then click Clear all Events.
Click Yes to save the contents of the log file before it is cleared. Then, save the log file .
Note
The event log size may also be configured by using Group Policy settings. We recommend that you verify that a Group Policy object is not configured to set the event log size before you change the size manually. For more information, see Event Log Policy Settings.
For More Information
For more information about memory tuning for Exchange Server 2003, see Microsoft Knowledge Base article 823440, Use of the /3GB switch in Exchange Server 2003 on a Windows Server 2003-based system.
For more information about the memory architecture in Windows Server 2003, see Microsoft Knowledge Base article 294418, Comparison of 32-bit and 64-bit memory architecture for 64-bit editions of Windows XP and Windows Server 2003.